Privacy
Policy.

1. Scope

This Privacy Policy explains how Cartuul Inc. ("Cartuul," "we," "us," or "our") collects, uses, and shares information across:

• Our website at cartuul.com and our related marketing pages and forms (the "Site"); and
• Our software platform at app.cartuul.com and any related mobile or web applications (the "Platform").

Some sections of this policy apply only to the Site or only to the Platform. We have flagged those sections clearly. The Cartuul services are intended for business users at automotive dealerships and their authorized vendors, and are not directed to individuals under 18 years of age.

Use of the Platform is also governed by the customer subscription agreement signed between your dealership and Cartuul. To the extent this policy conflicts with that agreement, the subscription agreement controls.

2. Information We Collect on the Website

Information you provide. When you fill out a demo request or contact form on the Site, we collect:

• Your name;
• Your business email address;
• Your phone number;
• Your dealership name; and
• Your dealership website.

We do not collect any other information through forms on the Site.

Information collected automatically. When you visit the Site, we and our service providers automatically collect certain information through cookies and similar technologies, including your IP address, browser type, device type, the pages you view, links you click, the website that referred you, and whether you open our emails and click links within them.

3. Information We Collect in the Platform

Account information. When your dealership sets up Cartuul accounts for its team members or vendors, we collect each user's name, business email address, phone number (where provided), role or title, and the dealership or vendor company they are associated with. Login activity, IP address, and device information are also recorded for security and audit purposes.

Operational data you enter. The Platform stores the information your dealership puts in. For example, vehicle and inventory records, reconditioning workflow data, vendor assignments, tasks, photos, notes, and timestamps. This is your dealership's operational data and is covered by the "Your Dealership's Data" section below.

Integration data. When your dealership authorizes a connection to a third-party system (such as a DMS, inventory management system, key management system, or parts provider), we receive data from those systems as needed to operate the integration. Cartuul only uses this data to provide the Platform features your dealership has enabled.

Usage information. We collect information about how your team uses the Platform, such as which features are used, when, and for how long, to operate, secure, and improve the service.

We do not use advertising pixels, retargeting tags, or third-party advertising trackers inside the Platform.

4. Your Dealership's Data

The operational data your dealership enters into the Platform, including vehicle records, reconditioning workflow data, vendor data, customer information, and any data flowing in through authorized integrations, belongs to your dealership.

Cartuul processes this data on your dealership's behalf for the purpose of providing the Platform. Specifically:

• We do not sell or share your dealership's operational data with anyone for advertising or marketing purposes.
• We do not use your dealership's operational data to train third-party AI or machine-learning models.
• We only access your dealership's data to provide and support the Platform, fix technical problems, comply with law, or as your dealership otherwise instructs.

If your dealership cancels its subscription, you can request deletion of your operational data by emailing us at info@cartuul.com. We may retain limited information as required by law or for legitimate business purposes (such as accounting records).

5. How We Use Your Information

We use the information we collect to:

• Provide, operate, secure, and improve the Site and the Platform;
• Respond to demo requests, support inquiries, and other communications;
• Set up and manage customer accounts and process payments;
• Send marketing and informational communications about Cartuul (you can opt out at any time);
• Measure and analyze Site traffic, engagement, and the effectiveness of our marketing;
• Show our advertising on third-party platforms to people who have visited the Site (retargeting, Site only, not Platform);
• Detect and prevent fraud and abuse, enforce our terms, and comply with applicable law.

6. Cookies and Tracking Technologies

On the Site. We use cookies and similar technologies (such as pixels and tags) on the Site. Some are necessary for the Site to function; others help us understand how visitors use the Site and allow us to deliver and measure advertising. We use Google Analytics and the Meta (Facebook) pixel to understand Site usage, improve performance, deliver advertising to people who have visited our Site ("retargeting"), and measure how our ads perform.

You can control cookies through your browser settings. Most browsers let you refuse or delete cookies, though some Site features may not work properly if you do. You can also:

• Opt out of interest-based advertising through the Digital Advertising Alliance (optout.aboutads.info) and the Network Advertising Initiative (optout.networkadvertising.org);
• Opt out of Google Analytics at tools.google.com/dlpage/gaoptout and adjust Google ad settings at adssettings.google.com; and
• Adjust Meta ad preferences within your Facebook or Instagram settings.

In the Platform. We use only the cookies and similar technologies necessary to operate the Platform, keep you signed in, and protect against fraud and abuse. We do not run advertising pixels, retargeting tags, or third-party advertising trackers inside the Platform.

Do Not Track: Because there is no common industry standard for how to respond to Do Not Track browser signals, our services do not currently respond to them. You can still use the cookie and advertising controls described above.

7. How We Share Information

We do not sell your personal information for money. We share information only in the following ways:

• Service providers: We share information with vendors who perform services for us, such as website hosting, our CRM and email platform, analytics providers, our payment processor, and Platform infrastructure providers, only as needed to provide those services. These providers are contractually required to protect the information and use it only to perform services for us.
• Site advertising and analytics partners: Through the cookies and pixels described above, we share certain online identifiers and activity from the Site with advertising and analytics partners such as Google and Meta to measure and deliver advertising, including retargeting. Under some U.S. state privacy laws, this activity may be considered "sharing" or a "sale" of personal information. You can opt out as described in "Your Privacy Rights" below. We do not engage in this activity inside the Platform.
• Authorized integrations: When your dealership connects the Platform to a third-party system (e.g., a DMS or parts provider), we exchange data with that system as needed to operate the integration your dealership has authorized.
• Legal and safety: We may disclose information to comply with the law, respond to legal process, protect our rights and the safety of others, or prevent fraud.
• Business transfers: If Cartuul is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

8. Your Choices

• Marketing emails: You can unsubscribe at any time using the link in any marketing email, or by emailing us at info@cartuul.com.
• Cookies and ads: Use your browser settings or the advertising opt-out tools listed above.
• Your information: You can ask us to update, correct, or delete the information you have provided by contacting us. Platform users should also contact their dealership administrator for changes to internal account information.

9. Your Privacy Rights

U.S. state privacy rights. Depending on your state of residence, you may have rights under laws such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and comparable laws in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Depending on where you live, these rights may include the right to:

• Know whether we are processing your personal information and access a copy of it;
• Correct inaccuracies in your personal information;
• Request deletion of your personal information, subject to legal exceptions;
• Obtain a copy of the personal information you previously provided;
• Opt out of the "sale" or "sharing" of your personal information and of targeted advertising; and
• Not be discriminated against for exercising your rights.

To opt out of the sharing of your information for advertising, use the "Do Not Sell My Info" link in our Site footer, your browser settings, and the advertising opt-out tools described above.

Categories of personal information we collect. The table below shows the categories of personal information (as defined under California law) we collect across the Site and the Platform:

How to exercise your rights. To exercise any of these rights, email us at info@cartuul.com or use the contact details below. We will verify your identity before responding, as required by law. You may use an authorized agent to submit a request on your behalf; we may require proof of authorization. If we decline to act on your request, you may appeal by emailing us at info@cartuul.com, and depending on your state you may contact your state attorney general.

Note for Platform users. If your dealership has provided your personal information to Cartuul as part of its use of the Platform, your dealership is the controller of that information. We will refer requests about Platform account data to your dealership and respond as the dealership instructs.

Canada. If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws may apply. We process your personal information with your consent, which may be expressed or implied depending on the context. You may withdraw your consent at any time by contacting us, and you may request access to, or correction of, the personal information we hold about you.

Quebec. If you are a resident of Quebec, additional rights apply under Quebec's Law 25. These include the right to be informed of the use of your personal information, to access and correct it, to withdraw consent, and, in certain circumstances, to request that we cease disseminating your personal information or de-index a link to it. The person responsible for the protection of personal information at Cartuul can be reached at info@cartuul.com.

10. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect the information we collect, including encryption in transit, access controls limiting who can view dealership data, and authentication procedures for Platform access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe an account has been compromised, contact us immediately at support@cartuul.com.

11. How Long We Keep Your Information

We keep your personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law (such as for tax, accounting, or regulatory purposes). Platform account and operational data is retained for the duration of your dealership's subscription and may be retained for a reasonable period after cancellation to allow for export, dispute resolution, and legal compliance. When we no longer need the information, we will delete or de-identify it.

12. Information from Minors

Our services are intended for business users at automotive dealerships and their authorized vendors, and are not directed to children. We do not knowingly collect personal information from anyone under 18 years of age. If you believe we have collected information from a minor, contact us at info@cartuul.com and we will take reasonable steps to delete it.

13. Third-Party Links and Integrations

The Site and the Platform may contain links to, or integrations with, third-party websites and services (such as DMS providers, CRM platforms, payment processors, and parts vendors). This policy applies only to Cartuul. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised effective date at the top of the policy. Material changes will be posted on the Site before they take effect, and we may notify Platform users by email or in-app notice.

15. How to Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

• Mail: Cartuul Inc., P.O. Box 6114, Philadelphia, PA 19115, United States
• Email: info@cartuul.com
• Phone: 1-866-227-8885 (1-866-CARTUUL)